# CVE-2026-116244: pgAdmin 4 Kerberos credential exposure authentication bypass

Source: https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116244 · Severity: high · CVSS 8.2 · Published 2026-10-30

pgAdmin 4 is a web-based database management tool for PostgreSQL. When configured to use Kerberos authentication, pgAdmin incorrectly fell back to the service account's credentials, allowing any user to connect to PostgreSQL databases as the service account regardless of their actual identity. This bypasses both explicit authentication restrictions and encryption-only modes, potentially exposing sensitive database access across an organization.

Technologies: [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4). Vendors: [pgAdmin](https://junglewise.ai/threats/vendors/pgadmin).

## Quick answers

**Is CVE-2026-116244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116244 being exploited in the wild.

**How severe is CVE-2026-116244?** High severity, with a CVSS score of 8.2, published 30 October 2026.

**Which products and versions are affected?** Pgadmin 4 before 9.19.

**Is there a fix for CVE-2026-116244?** Yes: fixed in pgAdmin 4 9.19. Until then: In server mode, restrict pgAdmin connections to servers that require require_auth=!gss,!sspi (requires libpq 16+) or set gssencmode=disable on all non-Kerberos connections. For utilities and psql spawned by pgAdmin, the same require_auth restrictions must be applied. Do not run pgAdmin under a service account with Kerberos credentials or keytabs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116244 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116244?** Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19

In server mode, restrict pgAdmin connections to servers that require require_auth=!gss,!sspi (requires libpq 16+) or set gssencmode=disable on all non-Kerberos connections. For utilities and psql spawned by pgAdmin, the same require_auth restrictions must be applied. Do not run pgAdmin under a service account with Kerberos credentials or keytabs.

## Technical details

The vulnerability occurs in pgAdmin's Kerberos environment handling: when a connection should not use Kerberos credentials, pgAdmin removes KRB5CCNAME from the environment, causing libpq's Kerberos library to fall back to the OS account's default credential cache or keytab. An attacker-controlled pgAdmin user can then connect to any PostgreSQL server configured for GSSAPI/SSPI authentication and be transparently authenticated as the service account's Kerberos principal, bypassing gssencmode=disable. On Windows, the same occurs via SSPI using the service account's logon.

## Affected products

- pgAdmin pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py)
- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/locker.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/locker.py)

## Related threats

- [pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when)
- [pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl)
- [pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share)
- [pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the)
- [pgAdmin 4 arbitrary code execution via binary path validation bypass](https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the)